AZL-113480: CVE-2026-97054 affecting package golang 1.27.4-1
For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can crash due to runtime panic if its handler reads the request body concurrently with writing the response header.
Affected Software
Event History
Frequently Asked Questions
What application behavior is required for exploitation?
The HTTP/1 server must use MaxBytesReader or MaxBytesHandler, have the configured body-size limit exceeded, and have its handler read the request body concurrently while writing the response header.
What is the likely impact if the issue is triggered?
The server can crash with a runtime panic. The description identifies this as a denial-of-service condition for affected HTTP/1 request handling.
Are HTTP/2 servers affected?
The provided information identifies the issue specifically in HTTP/1 servers. It does not state that HTTP/2 servers are affected.